@hasna/bridge 0.1.0 → 0.1.2

package/dist/index.js

@@ -4099,6 +4099,7 @@ function defaultConfigPath() {
 }
 
 // src/lib/config.ts
+var REDACTED_VALUE = "[redacted]";
 var channelSchema = exports_external.discriminatedUnion("kind", [
   exports_external.object({
     id: exports_external.string().min(1),
@@ -4186,6 +4187,31 @@ function parseConfig(value) {
   const parsed = configSchema.parse(value);
   return parsed;
 }
+function redactEnv(env) {
+  if (!env)
+    return;
+  return Object.fromEntries(Object.keys(env).map((key) => [key, REDACTED_VALUE]));
+}
+function redactEnvRecord(items) {
+  return Object.fromEntries(Object.entries(items).map(([id, item]) => {
+    const clone = { ...item };
+    if (item.env)
+      clone.env = redactEnv(item.env);
+    return [id, clone];
+  }));
+}
+function redactConfig(config) {
+  return {
+    ...config,
+    channels: Object.fromEntries(Object.entries(config.channels).map(([id, channel]) => [id, { ...channel }])),
+    profiles: redactEnvRecord(config.profiles),
+    agents: redactEnvRecord(config.agents),
+    routes: config.routes.map((route) => ({
+      ...route,
+      match: route.match ? { ...route.match, chatIds: route.match.chatIds ? [...route.match.chatIds] : undefined } : undefined
+    }))
+  };
+}
 async function loadConfig(configPath = defaultConfigPath()) {
   try {
     const raw = await readFile(configPath, "utf-8");
@@ -4233,55 +4259,73 @@ async function upsertRoute(route, configPath = defaultConfigPath()) {
   await saveConfig(config, configPath);
   return config;
 }
-// src/lib/doctor.ts
-import { access } from "fs/promises";
-async function commandExists(command) {
-  const proc = Bun.spawn(["sh", "-lc", `command -v ${command} >/dev/null 2>&1`], {
-    stdout: "ignore",
-    stderr: "ignore"
-  });
-  return await proc.exited === 0;
+// src/lib/daemon.ts
+import { spawn } from "child_process";
+import { closeSync, openSync } from "fs";
+import { chmod as chmod3, mkdir as mkdir3, readFile as readFile3, rename, rm, rmdir, stat, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join3, resolve } from "path";
+
+// src/lib/state.ts
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+function defaultStatePath() {
+  return process.env["BRIDGE_STATE"] || join2(bridgeHome(), "state.json");
 }
-async function doctor(configPath = defaultConfigPath()) {
-  const checks = [];
-  let config = await loadConfig(configPath);
+function emptyState() {
+  return { telegramOffsets: {} };
+}
+async function loadState(statePath = defaultStatePath()) {
   try {
-    await access(configPath);
-    checks.push({ name: "config", ok: true, detail: configPath });
-  } catch {
-    checks.push({ name: "config", ok: true, detail: `not created yet: ${configPath}` });
+    const raw = await readFile2(statePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return {
+      telegramOffsets: parsed.telegramOffsets && typeof parsed.telegramOffsets === "object" ? parsed.telegramOffsets : {}
+    };
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      return emptyState();
+    }
+    throw err;
   }
-  for (const command of ["bridge", "codewith", "claude", "aicopilot"]) {
-    checks.push({
-      name: `command:${command}`,
-      ok: command === "bridge" ? true : await commandExists(command),
-      detail: command === "bridge" ? "current package" : undefined
-    });
+}
+async function saveState(state, statePath = defaultStatePath()) {
+  await mkdir2(dirname2(statePath), { recursive: true, mode: 448 });
+  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+  await chmod2(statePath, 384);
+}
+
+// src/lib/telegram.ts
+var DEFAULT_TELEGRAM_API_BASE = "https://api.telegram.org";
+function telegramApiBase() {
+  const raw = process.env["BRIDGE_TELEGRAM_API_BASE"] || DEFAULT_TELEGRAM_API_BASE;
+  const parsed = new URL(raw);
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error("BRIDGE_TELEGRAM_API_BASE must use http or https");
   }
-  const telegramChannels = Object.values(config.channels).filter((channel) => channel.kind === "telegram");
-  for (const channel of telegramChannels) {
-    const envName = channel.botTokenEnv || "TELEGRAM_BOT_TOKEN";
-    checks.push({
-      name: `telegram-token:${channel.id}`,
-      ok: Boolean(process.env[envName]),
-      detail: envName
-    });
-    checks.push({
-      name: `telegram-allowlist:${channel.id}`,
-      ok: Boolean(channel.allowAllChats || channel.allowedChatIds?.length),
-      detail: channel.allowAllChats ? "allowAllChats=true" : `${channel.allowedChatIds?.length || 0} chat id(s)`
-    });
+  if (parsed.username || parsed.password) {
+    throw new Error("BRIDGE_TELEGRAM_API_BASE must not contain credentials");
   }
-  for (const route of config.routes) {
-    checks.push({
-      name: `route:${route.id}`,
-      ok: Boolean(config.channels[route.fromChannel] && config.agents[route.toAgent]),
-      detail: `${route.fromChannel} -> ${route.toAgent}`
-    });
+  if (parsed.search || parsed.hash) {
+    throw new Error("BRIDGE_TELEGRAM_API_BASE must not contain query strings or fragments");
   }
-  return { ok: checks.every((check) => check.ok), configPath, checks };
+  return parsed;
+}
+function telegramApiBaseInfo() {
+  const parsed = telegramApiBase();
+  return {
+    overridden: parsed.href.replace(/\/$/, "") !== DEFAULT_TELEGRAM_API_BASE,
+    origin: parsed.origin,
+    pathname: parsed.pathname
+  };
+}
+function telegramMethodUrl(token, method) {
+  const base = telegramApiBase();
+  const prefix = base.pathname.replace(/\/$/, "");
+  base.pathname = `${prefix}/bot${token}/${method}`;
+  base.search = "";
+  return base.toString();
 }
-// src/lib/telegram.ts
 function telegramToken(channel) {
   const envName = channel.botTokenEnv || "TELEGRAM_BOT_TOKEN";
   const token = process.env[envName];
@@ -4297,7 +4341,7 @@ function telegramChatAllowed(channel, chatId) {
   return Boolean(chatId && channel.allowedChatIds.includes(chatId));
 }
 async function sendTelegramMessage(token, chatId, text) {
-  const response = await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
+  const response = await fetch(telegramMethodUrl(token, "sendMessage"), {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({ chat_id: chatId, text })
@@ -4314,7 +4358,7 @@ async function getTelegramUpdates(token, options = {}) {
   if (options.offset !== undefined)
     params.set("offset", String(options.offset));
   params.set("timeout", String(options.timeoutSeconds ?? 20));
-  const response = await fetch(`https://api.telegram.org/bot${token}/getUpdates?${params.toString()}`);
+  const response = await fetch(`${telegramMethodUrl(token, "getUpdates")}?${params.toString()}`);
   const body = await response.json().catch(() => {
     return;
   });
@@ -4339,9 +4383,684 @@ function telegramUpdateToMessage(channelId, update) {
   };
 }
 
+// src/lib/daemon.ts
+function isNotFound(err) {
+  return Boolean(err && typeof err === "object" && "code" in err && err.code === "ENOENT");
+}
+function currentPlatformSupervisor() {
+  if (process.platform === "darwin")
+    return "launchd";
+  if (process.platform === "linux")
+    return "systemd";
+  return "process";
+}
+function resolveSupervisor(supervisor = "process") {
+  return supervisor === "auto" ? currentPlatformSupervisor() : supervisor;
+}
+function defaultDaemonDir() {
+  return join3(bridgeHome(), "daemon");
+}
+function daemonPaths(daemonDir = defaultDaemonDir()) {
+  const dir = resolve(daemonDir);
+  return {
+    dir,
+    lockDir: join3(dir, "lock"),
+    metadataFile: join3(dir, "bridge-daemon.json"),
+    stdoutLog: join3(dir, "bridge.out.log"),
+    stderrLog: join3(dir, "bridge.err.log"),
+    launchdPlist: join3(process.env["HOME"] || process.cwd(), "Library", "LaunchAgents", "com.hasna.bridge.plist"),
+    systemdUnit: join3(process.env["HOME"] || process.cwd(), ".config", "systemd", "user", "hasna-bridge.service")
+  };
+}
+async function ensureDaemonDir(dir = defaultDaemonDir()) {
+  const paths = daemonPaths(dir);
+  await mkdir3(paths.dir, { recursive: true, mode: 448 });
+  await chmod3(paths.dir, 448);
+  return paths;
+}
+async function fileExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (err) {
+    if (isNotFound(err))
+      return false;
+    throw err;
+  }
+}
+async function readMetadata(paths) {
+  try {
+    return JSON.parse(await readFile3(paths.metadataFile, "utf-8"));
+  } catch (err) {
+    if (isNotFound(err))
+      return;
+    throw err;
+  }
+}
+async function writeMetadata(paths, metadata) {
+  const tmp = `${paths.metadataFile}.${process.pid}.${Date.now()}.tmp`;
+  await writeFile3(tmp, `${JSON.stringify(metadata, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+  await chmod3(tmp, 384);
+  await rename(tmp, paths.metadataFile);
+  await chmod3(paths.metadataFile, 384);
+}
+async function withDaemonLock(paths, fn) {
+  try {
+    await mkdir3(paths.lockDir, { mode: 448 });
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+      throw new Error(`Another bridge daemon operation is already running: ${paths.lockDir}`);
+    }
+    throw err;
+  }
+  try {
+    return await fn();
+  } finally {
+    await rmdir(paths.lockDir).catch(() => {
+      return;
+    });
+  }
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function processCommand(pid) {
+  const proc = Bun.spawn(["ps", "-p", String(pid), "-o", "command="], {
+    stdout: "pipe",
+    stderr: "ignore"
+  });
+  if (await proc.exited !== 0)
+    return;
+  return (await new Response(proc.stdout).text()).trim();
+}
+async function processPgid(pid) {
+  const proc = Bun.spawn(["ps", "-p", String(pid), "-o", "pgid="], {
+    stdout: "pipe",
+    stderr: "ignore"
+  });
+  if (await proc.exited !== 0)
+    return;
+  const parsed = Number.parseInt((await new Response(proc.stdout).text()).trim(), 10);
+  return Number.isInteger(parsed) ? parsed : undefined;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function commandPattern(command) {
+  return command.map(shellQuote).join(" ");
+}
+async function processMatches(metadata) {
+  if (!pidAlive(metadata.pid))
+    return false;
+  const command = await processCommand(metadata.pid);
+  if (!command)
+    return false;
+  if (!metadata.pgid)
+    return false;
+  const pgid = await processPgid(metadata.pid);
+  if (pgid !== metadata.pgid)
+    return false;
+  const requiredArgs = [
+    metadata.command[1],
+    "serve",
+    "--config",
+    metadata.configPath,
+    "--state",
+    metadata.statePath,
+    "--interval",
+    String(metadata.intervalMs)
+  ].filter((arg) => Boolean(arg));
+  if (metadata.serveJson)
+    requiredArgs.push("--json");
+  return requiredArgs.every((arg) => command.includes(arg));
+}
+async function removeMetadata(paths) {
+  await rm(paths.metadataFile, { force: true });
+}
+function safeTelegramApiBaseInfo() {
+  try {
+    return telegramApiBaseInfo();
+  } catch (err) {
+    return {
+      overridden: true,
+      origin: "",
+      pathname: "",
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function startCommand(options) {
+  const scriptPath = process.argv[1];
+  const base = scriptPath ? [process.execPath, scriptPath] : ["bridge"];
+  const command = [
+    ...base,
+    "serve",
+    "--config",
+    options.configPath,
+    "--state",
+    options.statePath,
+    "--interval",
+    String(options.intervalMs)
+  ];
+  if (options.serveJson)
+    command.push("--json");
+  return command;
+}
+function telegramChannels(config) {
+  return Object.values(config.channels).filter((channel) => channel.kind === "telegram" && channel.enabled !== false);
+}
+function requiredTelegramEnvVars(config) {
+  return [...new Set(telegramChannels(config).map((channel) => channel.botTokenEnv || "TELEGRAM_BOT_TOKEN"))];
+}
+async function validateStartConfig(configPath) {
+  const config = await loadConfig(configPath);
+  const channels = telegramChannels(config);
+  if (!channels.length)
+    throw new Error("No enabled Telegram channels configured; add one before starting the daemon");
+  for (const envName of requiredTelegramEnvVars(config)) {
+    if (!process.env[envName])
+      throw new Error(`Missing Telegram bot token env var for daemon start: ${envName}`);
+  }
+}
+function openPrivateLog(path) {
+  const fd = openSync(path, "a", 384);
+  return fd;
+}
+async function ensurePrivateLogFiles(paths) {
+  for (const path of [paths.stdoutLog, paths.stderrLog]) {
+    const fd = openPrivateLog(path);
+    closeSync(fd);
+    await chmod3(path, 384);
+  }
+}
+async function runCapture(command) {
+  const proc = Bun.spawn(command, { stdout: "pipe", stderr: "pipe" });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  return { exitCode, stdout, stderr };
+}
+async function installedSupervisorStatus(supervisor, paths) {
+  if (supervisor === "launchd") {
+    if (!await fileExists(paths.launchdPlist))
+      return { running: false, detail: "launchd plist not installed" };
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    if (uid === undefined)
+      return { running: false, detail: "launchd status requires a numeric uid" };
+    const result = await runCapture(["launchctl", "print", `gui/${uid}/com.hasna.bridge`]);
+    if (result.exitCode !== 0)
+      return { running: false, detail: result.stderr.trim() || result.stdout.trim() || "launchd service not loaded" };
+    const running = /state\s*=\s*running/.test(result.stdout);
+    return { running, detail: running ? "launchd running" : "launchd loaded but not running" };
+  }
+  if (supervisor === "systemd") {
+    if (!await fileExists(paths.systemdUnit))
+      return { running: false, detail: "systemd unit not installed" };
+    const result = await runCapture(["systemctl", "--user", "is-active", "hasna-bridge.service"]);
+    const state = result.stdout.trim() || result.stderr.trim() || "unknown";
+    return { running: result.exitCode === 0 && state === "active", detail: `systemd ${state}` };
+  }
+  return { running: false, detail: "process supervisor has no installed status" };
+}
+async function daemonStatus(options = {}) {
+  const supervisor = resolveSupervisor(options.supervisor);
+  const paths = daemonPaths(options.daemonDir);
+  const metadata = await readMetadata(paths);
+  const live = metadata ? await processMatches(metadata) : false;
+  const stale = Boolean(metadata && !live);
+  const startedAt = metadata?.startedAt;
+  const uptimeSeconds = live && startedAt ? Math.max(0, Math.floor((Date.now() - Date.parse(startedAt)) / 1000)) : undefined;
+  const installed = {
+    launchd: await fileExists(paths.launchdPlist),
+    systemd: await fileExists(paths.systemdUnit)
+  };
+  const installedRuntime = supervisor === "process" ? undefined : await installedSupervisorStatus(supervisor, paths);
+  return {
+    running: installedRuntime ? installedRuntime.running : live,
+    stale: installedRuntime ? false : stale,
+    supervisor,
+    pid: metadata?.pid,
+    startedAt,
+    uptimeSeconds,
+    detail: installedRuntime?.detail || (stale ? "stale process metadata" : live ? "running" : "not running"),
+    installedDetail: installedRuntime?.detail,
+    metadata,
+    paths,
+    installed,
+    telegramApiBase: safeTelegramApiBaseInfo()
+  };
+}
+async function startProcessDaemon(options = {}) {
+  const paths = await ensureDaemonDir(options.daemonDir);
+  return withDaemonLock(paths, async () => {
+    const existing = await daemonStatus({ daemonDir: paths.dir, supervisor: "process" });
+    if (existing.running)
+      return existing;
+    if (existing.stale)
+      await removeMetadata(paths);
+    const configPath = resolve(options.configPath || defaultConfigPath());
+    const statePath = resolve(options.statePath || defaultStatePath());
+    const intervalMs = options.intervalMs ?? 1000;
+    const serveJson = Boolean(options.serveJson);
+    if (!Number.isInteger(intervalMs) || intervalMs < 0)
+      throw new Error("--interval must be a non-negative integer");
+    await validateStartConfig(configPath);
+    const stdoutFd = openPrivateLog(paths.stdoutLog);
+    const stderrFd = openPrivateLog(paths.stderrLog);
+    try {
+      const command = startCommand({ configPath, statePath, intervalMs, serveJson });
+      const child = spawn(command[0], command.slice(1), {
+        cwd: process.cwd(),
+        detached: true,
+        env: process.env,
+        stdio: ["ignore", stdoutFd, stderrFd]
+      });
+      child.unref();
+      const metadata = {
+        version: 1,
+        supervisor: "process",
+        pid: child.pid || 0,
+        pgid: child.pid || undefined,
+        startedAt: new Date().toISOString(),
+        identity: {
+          command: commandPattern(command),
+          cwd: process.cwd(),
+          configPath,
+          statePath,
+          daemonDir: paths.dir,
+          bridgeHome: bridgeHome()
+        },
+        command,
+        cwd: process.cwd(),
+        configPath,
+        statePath,
+        intervalMs,
+        serveJson,
+        daemonDir: paths.dir,
+        bridgeHome: bridgeHome(),
+        stdoutLog: paths.stdoutLog,
+        stderrLog: paths.stderrLog
+      };
+      if (!metadata.pid)
+        throw new Error("Failed to start bridge daemon process");
+      await writeMetadata(paths, metadata);
+      await Bun.sleep(200);
+      const status = await daemonStatus({ daemonDir: paths.dir, supervisor: "process" });
+      if (!status.running) {
+        await removeMetadata(paths);
+        throw new Error(`Bridge daemon failed to stay running; inspect ${paths.stderrLog}`);
+      }
+      return status;
+    } finally {
+      closeSync(stdoutFd);
+      closeSync(stderrFd);
+      await chmod3(paths.stdoutLog, 384).catch(() => {
+        return;
+      });
+      await chmod3(paths.stderrLog, 384).catch(() => {
+        return;
+      });
+    }
+  });
+}
+async function stopPid(pid, force) {
+  process.kill(-pid, force ? "SIGKILL" : "SIGTERM");
+}
+async function waitForExit(pid, timeoutMs) {
+  const started = Date.now();
+  while (Date.now() - started < timeoutMs) {
+    if (!pidAlive(pid))
+      return true;
+    await Bun.sleep(100);
+  }
+  return !pidAlive(pid);
+}
+async function stopProcessDaemon(options = {}) {
+  const paths = await ensureDaemonDir(options.daemonDir);
+  return withDaemonLock(paths, async () => {
+    const metadata = await readMetadata(paths);
+    if (!metadata)
+      return daemonStatus({ daemonDir: paths.dir, supervisor: "process" });
+    if (!await processMatches(metadata)) {
+      await removeMetadata(paths);
+      return daemonStatus({ daemonDir: paths.dir, supervisor: "process" });
+    }
+    await stopPid(metadata.pid, false);
+    let exited = await waitForExit(metadata.pid, options.timeoutMs ?? 5000);
+    if (!exited && options.force) {
+      await stopPid(metadata.pid, true);
+      exited = await waitForExit(metadata.pid, 2000);
+    }
+    if (!exited)
+      throw new Error(`Bridge daemon did not stop within ${options.timeoutMs ?? 5000}ms`);
+    await removeMetadata(paths);
+    return daemonStatus({ daemonDir: paths.dir, supervisor: "process" });
+  });
+}
+async function restartProcessDaemon(options = {}) {
+  const paths = daemonPaths(options.daemonDir);
+  const metadata = await readMetadata(paths);
+  await stopProcessDaemon(options);
+  return startProcessDaemon({
+    ...options,
+    configPath: options.configPath || metadata?.configPath,
+    statePath: options.statePath || metadata?.statePath,
+    intervalMs: options.intervalMs ?? metadata?.intervalMs,
+    serveJson: options.serveJson ?? metadata?.serveJson
+  });
+}
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function plistArray(values) {
+  return values.map((value) => `    <string>${xmlEscape(value)}</string>`).join(`
+`);
+}
+function renderLaunchdPlist(command, paths) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.hasna.bridge</string>
+  <key>ProgramArguments</key>
+  <array>
+${plistArray(command)}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(paths.stdoutLog)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(paths.stderrLog)}</string>
+  <key>WorkingDirectory</key>
+  <string>${xmlEscape(process.cwd())}</string>
+</dict>
+</plist>
+`;
+}
+function systemdEscape(value) {
+  return value.replaceAll("%", "%%").replaceAll(`
+`, " ");
+}
+function systemdQuote(value) {
+  return `"${systemdEscape(value).replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}"`;
+}
+function renderSystemdUnit(command, paths) {
+  return `[Unit]
+Description=Hasna Bridge daemon
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${command.map(systemdQuote).join(" ")}
+Restart=always
+RestartSec=5
+WorkingDirectory=${systemdEscape(process.cwd())}
+StandardOutput=append:${systemdEscape(paths.stdoutLog)}
+StandardError=append:${systemdEscape(paths.stderrLog)}
+
+[Install]
+WantedBy=default.target
+`;
+}
+async function installFile(path, content) {
+  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  await writeFile3(path, content, { encoding: "utf-8", mode: 384 });
+  await chmod3(path, 384);
+}
+async function installDaemon(options = {}) {
+  const supervisor = resolveSupervisor(options.supervisor || "auto");
+  if (supervisor === "process") {
+    throw new Error("The process supervisor does not need install; use `bridge daemon start`");
+  }
+  const paths = await ensureDaemonDir(options.daemonDir);
+  await ensurePrivateLogFiles(paths);
+  const configPath = resolve(options.configPath || defaultConfigPath());
+  const statePath = resolve(options.statePath || defaultStatePath());
+  const intervalMs = options.intervalMs ?? 1000;
+  const serveJson = Boolean(options.serveJson);
+  const command = startCommand({ configPath, statePath, intervalMs, serveJson });
+  const config = await loadConfig(configPath);
+  const requiredEnv = requiredTelegramEnvVars(config);
+  if (supervisor === "launchd") {
+    await installFile(paths.launchdPlist, renderLaunchdPlist(command, paths));
+    return {
+      supervisor,
+      path: paths.launchdPlist,
+      command,
+      requiredEnv,
+      warning: "Telegram token values are not written to launchd files. Set them in the launchd environment before starting."
+    };
+  }
+  await installFile(paths.systemdUnit, renderSystemdUnit(command, paths));
+  return {
+    supervisor,
+    path: paths.systemdUnit,
+    command,
+    requiredEnv,
+    warning: "Telegram token values are not written to systemd files. Import them into the user manager environment before starting."
+  };
+}
+async function runCommand(command) {
+  const { exitCode, stdout, stderr } = await runCapture(command);
+  if (exitCode !== 0)
+    throw new Error(`${command.join(" ")} failed (${exitCode}): ${stderr || stdout}`);
+}
+async function waitForInstalledRunning(supervisor, paths, timeoutMs = 5000) {
+  const started = Date.now();
+  let last = "";
+  while (Date.now() - started < timeoutMs) {
+    const status = await installedSupervisorStatus(supervisor, paths);
+    last = status.detail;
+    if (status.running)
+      return;
+    await Bun.sleep(250);
+  }
+  throw new Error(`${supervisor} service did not report running: ${last}`);
+}
+async function startInstalledDaemon(options = {}) {
+  const result = await installDaemon(options);
+  const paths = daemonPaths(options.daemonDir);
+  if (result.supervisor === "launchd") {
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    if (uid === undefined)
+      throw new Error("launchd start requires a numeric uid");
+    await runCommand(["launchctl", "bootstrap", `gui/${uid}`, result.path]).catch(async (err) => {
+      if (!String(err).includes("Input/output error"))
+        throw err;
+      await runCommand(["launchctl", "kickstart", "-k", `gui/${uid}/com.hasna.bridge`]);
+    });
+    await waitForInstalledRunning(result.supervisor, paths);
+    return result;
+  }
+  await runCommand(["systemctl", "--user", "daemon-reload"]);
+  await runCommand(["systemctl", "--user", "enable", "--now", "hasna-bridge.service"]);
+  await waitForInstalledRunning(result.supervisor, paths);
+  return result;
+}
+async function stopInstalledDaemon(options = {}) {
+  const supervisor = resolveSupervisor(options.supervisor || "auto");
+  const paths = daemonPaths(options.daemonDir);
+  if (supervisor === "launchd") {
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    if (uid === undefined)
+      throw new Error("launchd stop requires a numeric uid");
+    await runCommand(["launchctl", "bootout", `gui/${uid}`, paths.launchdPlist]);
+    return;
+  }
+  if (supervisor === "systemd") {
+    await runCommand(["systemctl", "--user", "disable", "--now", "hasna-bridge.service"]);
+    return;
+  }
+  await stopProcessDaemon(options);
+}
+async function restartInstalledDaemon(options = {}) {
+  const supervisor = resolveSupervisor(options.supervisor || "auto");
+  if (supervisor === "process")
+    return restartProcessDaemon(options);
+  await stopInstalledDaemon({ ...options, supervisor }).catch(() => {
+    return;
+  });
+  return startInstalledDaemon({ ...options, supervisor });
+}
+async function uninstallDaemon(options = {}) {
+  const supervisor = resolveSupervisor(options.supervisor || "auto");
+  const paths = daemonPaths(options.daemonDir);
+  const removed = [];
+  if (supervisor === "launchd") {
+    await stopInstalledDaemon({ ...options, supervisor }).catch(() => {
+      return;
+    });
+    await rm(paths.launchdPlist, { force: true });
+    removed.push(paths.launchdPlist);
+  } else if (supervisor === "systemd") {
+    await stopInstalledDaemon({ ...options, supervisor }).catch(() => {
+      return;
+    });
+    await rm(paths.systemdUnit, { force: true });
+    await runCommand(["systemctl", "--user", "daemon-reload"]).catch(() => {
+      return;
+    });
+    removed.push(paths.systemdUnit);
+  } else {
+    await stopProcessDaemon({ ...options, supervisor }).catch(() => {
+      return;
+    });
+    await removeMetadata(paths);
+    removed.push(paths.metadataFile);
+  }
+  return { supervisor, removed };
+}
+async function tailFile(path, lines) {
+  try {
+    const raw = await readFile3(path, "utf-8");
+    return raw.split(/\r?\n/).slice(-Math.max(1, lines)).join(`
+`);
+  } catch (err) {
+    if (isNotFound(err))
+      return "";
+    throw err;
+  }
+}
+async function daemonLogs(options = {}) {
+  const paths = daemonPaths(options.daemonDir);
+  const lines = options.lines ?? 100;
+  return {
+    stdout: await tailFile(paths.stdoutLog, lines),
+    stderr: await tailFile(paths.stderrLog, lines),
+    paths
+  };
+}
+// src/lib/doctor.ts
+import { stat as stat2 } from "fs/promises";
+function isNotFound2(err) {
+  return Boolean(err && typeof err === "object" && "code" in err && err.code === "ENOENT");
+}
+async function privateFileCheck(name, path) {
+  try {
+    const info = await stat2(path);
+    const mode = info.mode & 511;
+    const ok = (mode & 63) === 0;
+    return { name, ok, detail: `${path} mode=${mode.toString(8)}` };
+  } catch (err) {
+    if (isNotFound2(err))
+      return { name, ok: true, detail: `not created yet: ${path}` };
+    return { name, ok: false, detail: `${path}: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+async function privateDirCheck(name, path) {
+  try {
+    const info = await stat2(path);
+    const mode = info.mode & 511;
+    const ok = (mode & 63) === 0;
+    return { name, ok, detail: `${path} mode=${mode.toString(8)}` };
+  } catch (err) {
+    if (isNotFound2(err))
+      return { name, ok: true, detail: `not created yet: ${path}` };
+    return { name, ok: false, detail: `${path}: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+async function commandExists(command) {
+  const proc = Bun.spawn(["sh", "-lc", `command -v ${command} >/dev/null 2>&1`], {
+    stdout: "ignore",
+    stderr: "ignore"
+  });
+  return await proc.exited === 0;
+}
+async function doctor(configPath = defaultConfigPath(), statePath = defaultStatePath()) {
+  const checks = [];
+  const config = await loadConfig(configPath);
+  const daemon = await daemonStatus();
+  const paths = daemonPaths();
+  checks.push(await privateFileCheck("config", configPath));
+  checks.push(await privateFileCheck("state", statePath));
+  checks.push(await privateDirCheck("daemon-dir", paths.dir));
+  checks.push(await privateFileCheck("daemon-metadata", paths.metadataFile));
+  checks.push({
+    name: "daemon-status",
+    ok: !daemon.stale,
+    detail: daemon.running ? `running pid=${daemon.pid}` : daemon.stale ? `stale pid=${daemon.pid}` : "not running"
+  });
+  try {
+    const apiBase = telegramApiBaseInfo();
+    checks.push({
+      name: "telegram-api-base",
+      ok: true,
+      detail: apiBase.overridden ? `overridden: ${apiBase.origin}${apiBase.pathname}` : apiBase.origin
+    });
+  } catch (err) {
+    checks.push({
+      name: "telegram-api-base",
+      ok: false,
+      detail: err instanceof Error ? err.message : String(err)
+    });
+  }
+  for (const command of ["bridge", "codewith", "claude", "aicopilot"]) {
+    checks.push({
+      name: `command:${command}`,
+      ok: command === "bridge" ? true : await commandExists(command),
+      detail: command === "bridge" ? "current package" : undefined
+    });
+  }
+  const telegramChannels2 = Object.values(config.channels).filter((channel) => channel.kind === "telegram");
+  for (const channel of telegramChannels2) {
+    const envName = channel.botTokenEnv || "TELEGRAM_BOT_TOKEN";
+    checks.push({
+      name: `telegram-token:${channel.id}`,
+      ok: Boolean(process.env[envName]),
+      detail: envName
+    });
+    checks.push({
+      name: `telegram-allowlist:${channel.id}`,
+      ok: Boolean(channel.allowAllChats || channel.allowedChatIds?.length),
+      detail: channel.allowAllChats ? "allowAllChats=true" : `${channel.allowedChatIds?.length || 0} chat id(s)`
+    });
+  }
+  for (const route of config.routes) {
+    checks.push({
+      name: `route:${route.id}`,
+      ok: Boolean(config.channels[route.fromChannel] && config.agents[route.toAgent]),
+      detail: `${route.fromChannel} -> ${route.toAgent}`
+    });
+  }
+  return { ok: checks.every((check) => check.ok), configPath, checks };
+}
 // src/lib/router.ts
 function matchingRoutes(config, message) {
   const channel = config.channels[message.channelId];
+  if (!channel || channel.enabled === false)
+    return [];
   if (channel?.kind === "telegram" && !telegramChatAllowed(channel, message.chatId)) {
     return [];
   }
@@ -4369,6 +5088,10 @@ async function routeMessage(config, message, options = {}) {
     let deliveredResponse = false;
     const channel = responseChannel(config, route, message);
     const responseText = agent.stdout.trim();
+    if (channel?.enabled === false) {
+      results.push({ route, agent, deliveredResponse });
+      continue;
+    }
     if (responseText && channel?.kind === "telegram" && message.chatId) {
       if (!telegramChatAllowed(channel, message.chatId)) {
         results.push({ route, agent, deliveredResponse });
@@ -4385,61 +5108,52 @@ async function routeMessage(config, message, options = {}) {
   }
   return results;
 }
-// src/lib/state.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join2 } from "path";
-function defaultStatePath() {
-  return process.env["BRIDGE_STATE"] || join2(bridgeHome(), "state.json");
-}
-function emptyState() {
-  return { telegramOffsets: {} };
-}
-async function loadState(statePath = defaultStatePath()) {
-  try {
-    const raw = await readFile2(statePath, "utf-8");
-    const parsed = JSON.parse(raw);
-    return {
-      telegramOffsets: parsed.telegramOffsets && typeof parsed.telegramOffsets === "object" ? parsed.telegramOffsets : {}
-    };
-  } catch (err) {
-    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
-      return emptyState();
-    }
-    throw err;
-  }
-}
-async function saveState(state, statePath = defaultStatePath()) {
-  await mkdir2(dirname2(statePath), { recursive: true, mode: 448 });
-  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
-`, { encoding: "utf-8", mode: 384 });
-  await chmod2(statePath, 384);
-}
 export {
   upsertRoute,
   upsertProfile,
   upsertChannel,
   upsertAgent,
+  uninstallDaemon,
   telegramUpdateToMessage,
   telegramToken,
   telegramChatAllowed,
+  telegramApiBaseInfo,
+  tailFile,
+  stopProcessDaemon,
+  stopInstalledDaemon,
+  startProcessDaemon,
+  startInstalledDaemon,
   sendTelegramMessage,
   saveState,
   saveConfig,
   runAgent,
   routeMessage,
+  restartProcessDaemon,
+  restartInstalledDaemon,
+  resolveSupervisor,
   resolveAgent,
+  requiredTelegramEnvVars,
+  renderSystemdUnit,
+  renderLaunchdPlist,
+  redactConfig,
   parseConfig,
   matchingRoutes,
   loadState,
   loadConfig,
+  installDaemon,
   homeDir,
   getTelegramUpdates,
+  ensureDaemonDir,
   ensureConfig,
   emptyState,
   emptyConfig,
   doctor,
   defaultStatePath,
+  defaultDaemonDir,
   defaultConfigPath,
+  daemonStatus,
+  daemonPaths,
+  daemonLogs,
   buildAgentCommand,
   bridgeHome,
   CONFIG_VERSION,